They don't want to build basic auth. They probably could, but it gives them more headaches and customer service touch points compared to delegating that out. Li

They don't want to build basic auth. They probably could, but it gives them more headaches and customer service touch points compared to delegating that out. Like: what if the user forgets their password? Or what if they lose their 2FA device?